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REMARKS 

The Examiner has rejected Claims 1-13 under 35 U.S.C. 101 as being non- 
statutory, since such claims allegedly represent a computer listing per se, that is, non- 
functional descriptive material, etc. Applicant respectfully disagrees. Specifically, 
applicant clearly claims a "computer program product for operating a computer to review 
files for potential malware " (emphasis added), clearly a functional set of acts being 
performed. 

The Examiner has rejected Claims 1-2, 7-12, 14-15, 20-25, 27-28 and 33-38 under 
35 U.S.C. 103(a) as being unpatentable over Chess et al. (U.S. Patent No. 6,71 1,583) in 
view of Smithson et al. (U.S. Patent No. 6,886,099). Applicant respectfully disagrees 
with such rejection. 

With respect to each of the independent claims, the Examiner has responded to 
applicant's arguments with respect to applicant's claimed "logging code operable to 
maintain a statistical log having an entry for each file sent to the computer for review, 
each entry being arranged to store a count value indicating the number of times that the 
file has been sent to the computer for review and a value of one or more predetermined 
attributes relating to the file" (see this or similar, but not necessarily identical language in 
each of the independent claims). 

Specifically, the Examiner has stated that the Abstract of Smithson teaches "the 
tracking for a number of times a file is sent for review." Applicant respectfully asserts 
that the Abstract in Smithson only discloses measuring "how many E-mail messages are 
sent having an identical file attachment, the file type or simply in total." Clearly, 
measuring how many E-mail messages are sent , as in Smithson, does not meet 
applicant's specific claim language, namely "stor[ing] a count value indicating the 
number of times that the file has been sent to the computer for review " (emphasis added), 
as claimed. 



-2- 



In addition, the Examiner has stated that Col. 5, lines 5-48 in Chess teach 
"keeping a value of one or more predetermined attributes relating to the file, such as 
whether the file is safe or questionable." First, applicant respectfully asserts that such 
excerpt in Chess only teaches "examining] documents in the collection on disk," and not 
"a statistical log having an entry for each file sent to the computer for review ," as 
applicant claims (emphasis added). Second, Chess merely discloses storing "the 
document name and macro data" associated with the document, where the macro data is 
the names of any macro data stored in the document. Clearly, such data does not meet 
applicant's claimed " value of one or more predetermined attributes relating the file" 
(emphasis added). Thus, in view of the above arguments, applicant respectfully asserts 
that neither Smithson nor Chess meet applicant's specific claim language. 

Still with respect to each of the independent claims, the Examiner has responded 
to applicant's claimed "weighting indicating the likelihood that a file having that value of 
said one or more predetermined attributes will be malware" and "referenc[ing] the 
weighting table to determine the weighting to be associated with the file, based on the 
value of said one or more predetermined attributes associated with that file in the 
statistical log" (see this or similar, but not necessarily identical language in each of the 
independent claims). 

Specifically, the Examiner has argued that "Chess discloses a technique for 
determining the likelihood of a file being infected by the addition or change of code since 
the last time the file has been reviewed" (Col. 5, lines 5-48). Applicant respectfully 
asserts that simply comparing macro data to determine if "safe" changes or 
"questionable" changes have occurred, as in Chess, does not even suggest any sort of 
weighting table . Instead, Chess teaches that "removing one or more macros from the 
document could be considered 'safe', whereas the modification or addition of macros to 
the document.could be considered 'questionable'." 

Thus, Chess determines whether a document has safe or questionable changes 
made to it based on whether a change involved the removal or addition of macros, which 



clearly does not even suggest the utilization of a weighting table, and especially not in the 
context claimed by applicant. In addition, since Chess does not disclose storing any sort 
of value of one or more predetermined attributes relating to the file, in the manner 
claimed by applicant, Chess simply would not utilize a weighting table for determining 
the weighting to be associated with the file, based on the value of said one or more 
predetermined attributes associated with that file, as applicant specifically claims. 

Still with respect to each of the independent claims, the Examiner has failed to 
responded to applicant's arguments with respect to applicant's claimed "statistical log 
interface code operable, upon receipt of a file, to determine with reference to the 
statistical log the count value relating to that file; action determination code operable, if 
the count value determined by the statistical log interface code exceeds a predetermined 
threshold" (see this or similar, but not necessarily identical language in each of the 
independent claims). In particular, the Examiner has merely stated that "the combination 
of [Smithson and Chess] disclose referencing a weighting table to determine the 
weighting to be associated with the file, based on the value of said one or more 
predetermined attributes associated with that file in the statistical log." 

Applicant respectfully asserts that what is claimed is "determin[ing] with 
reference to the statistical log the count value relating to that file" (emphasis added). For 
substantially the reasons argued above, applicant emphasizes that neither Chess nor 
Smithson teach any sort of value in the context claimed by applicant, and thus it is 
impossible for the references to teach a situation where "upon receipt of a 
file...determin[ing] with reference to the statistical log the count value relating to that 
file," as claimed by applicant. 

To establish a prima facie case of obviousness, three basic criteria must be met. 
First, there must be some suggestion or motivation, either in the references themselves or 
in the knowledge generally available to one of ordinary skill in the art, to modify the 
reference or to combine reference teachings. Second, there must be a reasonable 
expectation of success. Finally, the prior art reference (or references when combined) 



must teach or suggest all the claim limitations. The teaching or suggestion to make the 
claimed combination and the reasonable expectation of success must both be found in the 
prior art and not based on applicant's disclosure. In re Vaeck,947 F.2d 488, 20 USPQ2d 
1438 (Fed.Cir.l991). 

Applicant respectfully asserts that at least the third element of the prima facie 
case of obviousness has not been met, since the prior art references, when combined, fail 
to teach or suggest all of the claim limitations, as noted above. Thus, a notice of 
allowance or a specific prior art showing of all of applicant's claim limitations, in 
combination with the remaining claim elements, is respectfully requested. 



Applicant further notes that the Examiner has failed to respond to applicant's 
arguments with respect to dependent Claim 1 1 et al. Applicant again notes that the 
Examiner has relied on the following excerpts from the Smithson reference to make a 
prior art showing of applicant's claimed "each entry in the statistical log ... further 
arranged to identify, for each sender of that file, the number of times that that sender has 
sent the file in addition to the count value indicating the total number of times that the file 
has been sent" (see this or similar, but not necessarily identical language in each of the 
independent claims). 



"As preferred examples of the measurement parameters that may be 
used there are proposed: 

1. How many E-mail messages are sent having an identical 
message title. 

2. How many E-mail messages are sent identical file attachment. 

3 . How many email messages are sent having a file attachment of a 
given file type. 

4. How many E-mail messages are sent having a file attachment 
that is an executable file. 

5. The E-mail through put within the computer system. 

6. The E-mail throughput measured in a form dependent upon a 
number of E-mails multiplied by a total size for the E-mails." 
(Col. 4, lines 25-40) 

Again, as noted above, Smithson's measurement parameters and thresholds are 
associated with aggregate file activity , and not a particular file. To this end, Smithson 
simply fails to meet applicant's claimed "number of times that that sender has sent the 
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file in addition to the count value indicating the total number of times that the file has 
been sent." It is further noted that the measurement parameters does not track a per- 
sender number, and thus fails to meet applicant's claimed "each entry in the statistical log 
. . . further arranged to identify, for each sender of that file , the number of times that that 
sender has sent the file in addition to the count value indicating the total number of times 
that the file has been sent" (emphasis added). 

Thus, only applicant teaches and claims use of both 1) a number of times that a 
particular sender has sent a file, and 2) a total number of times the file has been sent 
irrespective of sender in each entry in the statistical log. Note Table 1 below which 
illustrates such claimed subject matter. 

Table 1 

Entry_l (associated with file l) 
Sender_l 

Number of times file_l is sent by SenderJ 
Sender_2 

Number of times file_l is sent by Sender_2 
Total number of times file_l is sent 

Entry_2 (associated with file_2) 

SenderJ 

Number of times file_2 is sent by Sender_l 
Sender_2 

Number of times file_2 is sent by Sender_2 
Total number of times file_2 is sent 

Again, a notice of allowance or a specific prior art showing of all of applicant's 
claim limitations, in combination with the remaining claim elements, is respectfully 
requested. 



